// https://syzkaller.appspot.com/bug?id=d229f74aba6a7a9700e4cf1997ac1ae5236862c9
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/prctl.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

static void sleep_ms(uint64_t ms)
{
  usleep(ms * 1000);
}

static uint64_t current_time_ms(void)
{
  struct timespec ts;
  if (clock_gettime(CLOCK_MONOTONIC, &ts))
    exit(1);
  return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}

static bool write_file(const char* file, const char* what, ...)
{
  char buf[1024];
  va_list args;
  va_start(args, what);
  vsnprintf(buf, sizeof(buf), what, args);
  va_end(args);
  buf[sizeof(buf) - 1] = 0;
  int len = strlen(buf);
  int fd = open(file, O_WRONLY | O_CLOEXEC);
  if (fd == -1)
    return false;
  if (write(fd, buf, len) != len) {
    int err = errno;
    close(fd);
    errno = err;
    return false;
  }
  close(fd);
  return true;
}

static void kill_and_wait(int pid, int* status)
{
  kill(-pid, SIGKILL);
  kill(pid, SIGKILL);
  for (int i = 0; i < 100; i++) {
    if (waitpid(-1, status, WNOHANG | __WALL) == pid)
      return;
    usleep(1000);
  }
  DIR* dir = opendir("/sys/fs/fuse/connections");
  if (dir) {
    for (;;) {
      struct dirent* ent = readdir(dir);
      if (!ent)
        break;
      if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
        continue;
      char abort[300];
      snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
               ent->d_name);
      int fd = open(abort, O_WRONLY);
      if (fd == -1) {
        continue;
      }
      if (write(fd, abort, 1) < 0) {
      }
      close(fd);
    }
    closedir(dir);
  } else {
  }
  while (waitpid(-1, status, __WALL) != pid) {
  }
}

static void setup_test()
{
  prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
  setpgrp();
  write_file("/proc/self/oom_score_adj", "1000");
}

static void execute_one(void);

#define WAIT_FLAGS __WALL

static void loop(void)
{
  int iter = 0;
  for (;; iter++) {
    int pid = fork();
    if (pid < 0)
      exit(1);
    if (pid == 0) {
      setup_test();
      execute_one();
      exit(0);
    }
    int status = 0;
    uint64_t start = current_time_ms();
    for (;;) {
      if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
        break;
      sleep_ms(1);
      if (current_time_ms() - start < 5000)
        continue;
      kill_and_wait(pid, &status);
      break;
    }
  }
}

uint64_t r[1] = {0xffffffffffffffff};

void execute_one(void)
{
  intptr_t res = 0;
  res = syscall(__NR_socket, 0x1eul, 1ul, 0);
  if (res != -1)
    r[0] = res;
  *(uint16_t*)0x20000000 = 0x1e;
  *(uint8_t*)0x20000002 = 2;
  *(uint8_t*)0x20000003 = 0;
  *(uint32_t*)0x20000004 = 1;
  *(uint32_t*)0x20000008 = 1;
  *(uint32_t*)0x2000000c = 0;
  syscall(__NR_connect, r[0], 0x20000000ul, 0x10ul);
  *(uint64_t*)0x20005fc0 = 0;
  *(uint32_t*)0x20005fc8 = 4;
  *(uint64_t*)0x20005fd0 = 0;
  *(uint64_t*)0x20005fd8 = 0;
  *(uint64_t*)0x20005fe0 = 0;
  *(uint64_t*)0x20005fe8 = 0;
  *(uint32_t*)0x20005ff0 = 0;
  *(uint32_t*)0x20005ff8 = 0;
  *(uint64_t*)0x20006000 = 0;
  *(uint32_t*)0x20006008 = 0;
  *(uint64_t*)0x20006010 = 0;
  *(uint64_t*)0x20006018 = 0;
  *(uint64_t*)0x20006020 = 0;
  *(uint64_t*)0x20006028 = 0;
  *(uint32_t*)0x20006030 = 0;
  *(uint32_t*)0x20006038 = 0;
  *(uint64_t*)0x20006040 = 0;
  *(uint32_t*)0x20006048 = 0;
  *(uint64_t*)0x20006050 = 0;
  *(uint64_t*)0x20006058 = 0;
  *(uint64_t*)0x20006060 = 0;
  *(uint64_t*)0x20006068 = 0;
  *(uint32_t*)0x20006070 = 0;
  *(uint32_t*)0x20006078 = 0;
  *(uint64_t*)0x20006080 = 0;
  *(uint32_t*)0x20006088 = 0;
  *(uint64_t*)0x20006090 = 0;
  *(uint64_t*)0x20006098 = 0;
  *(uint64_t*)0x200060a0 = 0;
  *(uint64_t*)0x200060a8 = 0;
  *(uint32_t*)0x200060b0 = 0;
  *(uint32_t*)0x200060b8 = 0;
  *(uint64_t*)0x200060c0 = 0;
  *(uint32_t*)0x200060c8 = 0;
  *(uint64_t*)0x200060d0 = 0x200025c0;
  *(uint64_t*)0x200025c0 = 0x20001300;
  memcpy((void*)0x20001300,
         "\x17\x55\x91\xb3\x04\xdd\x9b\x25\x20\x3e\x46\xdd\xca\xb1\x99\x88\x5f"
         "\x6f\x03\x94\x5b\xae\x77\xbf\xa0\x5d\x74\x9c\x87\x4f\x82\x6e\xa1\xc1"
         "\xa3\x74\x17\x6f\xf4\x26\xfa\xef\x62\xee\x1f\x5a\x45\x23\x2e\x2e\x41"
         "\x63\xa8\xcc\x12\x04\xac\xf5\x56\x8a\x1d\x0b\x93\x73\xfa\xd0\x1e\x1c"
         "\x02\xe0\xa5\x70\xb0\xd3\x15\x55\x1e\x85\x78\x74\xfe\x7a\x30\x04\xb7"
         "\x43\xdb\x82\x16\xec\xf0\xb4\xf8\x5c\xc3\xac",
         96);
  *(uint64_t*)0x200025c8 = 0x20001360;
  *(uint64_t*)0x200025d0 = 0x20001380;
  memcpy((void*)0x20001380,
         "\x44\xbf\x0a\x94\xa0\x58\x5c\x47\x91\xc0\x20\x96\xd5\xe8\x45\x56\x6a"
         "\xe8\x44\xca\x4a\xd8\xe6\x5d\xfe\x8a\xb9\xe1\x0b\x33\x64\xbe\xa8\xf4"
         "\x6b\xe1\x9b\xf6\xa3\xdc\x7b\x7b\x62\x6d\x13\x62\x5e\xf4\x35\xb1\x29"
         "\x1d\x33\x56\x42\x4c\x4a\x26\x5e\x6a\xe8\x2f\xfc\xdb\x39\x38\xf3\xa2"
         "\x1e\xae\x15\x42\x0b\xb9\x0c\xd6\xae\x44\xa2\x80\x37\x90\x63\x6f",
         84);
  *(uint64_t*)0x200025d8 = 0x54;
  *(uint64_t*)0x200025e0 = 0x20001400;
  memcpy(
      (void*)0x20001400,
      "\x22\xff\x50\xd4\xdd\xda\xce\x90\x0f\x6d\x79\xc1\xfe\x27\xb4\x73\x24\x3e"
      "\x83\xbb\xbb\xa8\x99\x2e\x7f\xa5\xe9\xee\x19\x2d\x69\x3d\x1a\x82\xc3\x25"
      "\x2e\x21\xcd\x55\xd5\xcb\x1e\x3a\x82\xeb\x24\x4b\xed\xab\x40\x30\x7f\x78"
      "\x59\xde\x6b\xdc\x0f\x2d\x86\xc2\xaf\x0c\xf3\x55\xf4\xb0\xb4\x8a\x4a\x48"
      "\x11\x98\xa3\x76\x66\xb8\xc1\x07\x64\xe6\x91\xbd\x4d\xa0\x51\xe0\x11\x0b"
      "\xa3\x5c\xf9\x3d\x59\x09\x4a\x5c\x12\x3a\x45\x1d\xcb\x39\xf5\xfa\xbb\x0c"
      "\x18\x5b\xc5\x91\x87\x2c\xcd\x04\x08\xcd\x51\xd3\x5c\xc3\x41\xb9\x74\x5e"
      "\xa3\x75\x5e\x54\x39\x56\x6c\x05\x8e\x1c\xa2\xef\x99\x3a\xba\x2d\x88\xab"
      "\xff\xc1\xfb\x92\x89\x67\x14\x6b\xa9\xba\xa0\xa2\x56\x53\x70\x3c\x37\xc3"
      "\x54\x71\xe0\x21\x18\x45\xb9\xb5\x40\xe3\x97\xe9\xb6\x1c\x49\x8a\x98\x85"
      "\x0a\x2e\xe5\xc0\xce\x3e\xff\xe9\x9a\x38\x44\x96\xea\x56\xb8\x78\xe8\x6e"
      "\xa7\xd1\x9f\xca\xa8\xaf\xc4\xd2\x19\x39\x17\xc6\x84\xe2\xed\x91\x3f\xb9"
      "\x3a\xad\x38\xe7\x3c\x4d\x49\xa4\xc0\xc9\x32\x47\x59\x3d\x57\xa5\xc9\xfb"
      "\xea\x02\x93\x0e\x66\xe3\xcb\x0a\x07\xe8\xd6\x73\xfc\x7e\x5a\x48\x3d\xe7"
      "\xe7\x8e\xc3\x5b\xfa\xa0\xf3\xe7\xfe\xdf\x9e\x49\x0d\x64\x0b\x24\xab\xdf"
      "\xfc\xd5\x55\xec\x1d\xd8\x04\x0d\x27\xb0\xe2\xfb\xf4\xfc\xda\x18\xe8\x1d"
      "\x1d\x9f\xff\x91\x62\x7e\xa1\x7e\xf7\xd1\xc3\xf5\x36\xee\x11\x89\x2b\xd6"
      "\x84\x17\x0b\xdf\xeb\x38\x9b\x1d\xcd\xef\x01\xf6\x80\xab\xd1\xeb\x87\x8f"
      "\x36\x6b\xab\x06\x77\x42\xde\x2a\xd3\xb4\x3f\xa8\xfe\x27\x73\x5f\x09\xec"
      "\x35\x8f\x05\x89\x9f\xb2\x5e\x5f\x91\x1c\x61\x0b\x6e\x04\x97\x76\x32\xd2"
      "\x51\xb6\xdf\x05\xbd\xe9\x8b\x8d\xdc\x73\x5d\x13\x31\xd5\x6e\x7e\x39\x9f"
      "\x11\x47\xc3\x4f\x09\x53\xac\xbb\xc9\x5f\xfc\x19\x72\x39\x34\xfa\x82\x54"
      "\xff\x8a\xfb\x4e\x1d\x95\x6d\x7c\x4d\x7e\x33\x5c\x9c\x18\x53\x0e\x35\x88"
      "\x69\x81\xa1\x2e\xe5\x4d\xf2\xa0\xbc\xa6\x1e\xad\x97\x3c\xc8\x76\x92\xb6"
      "\x19\x01\x74\xed\xf9\x3f\x91\x1c\xda\x14\x63\xb7\xa3\x38\x46\x2a\xb8\xd0"
      "\xda\x1a\xf4\xac\xef\x88\x34\xe5\xad\xf3\x10\x94\x27\xa6\x85\x09\xb1\xfe"
      "\x9b\x16\x9c\xe9\x35\x47\x97\xba\xb3\x71\xc8\x70\xc3\x34\xd2\x17\x56\xe7"
      "\x62\x5e\xd5\x3c\x8e\xdd\x58\xed\x21\x5f\xfa\xdf\x4f\xab\xbc\x58\xb7\x88"
      "\xa9\x81\x3e\xc5\x85\xa9\xfb\x57\x98\xc4\x67\xcb\x94\x0e\xe6\x51\xc2\x1a"
      "\x53\xd1\x88\x3f\xea\x0b\xec\xbb\xc0\x89\xbd\xe6\x25\xf4\xb3\xf6\xa9\xd5"
      "\x6f\x83\xc5\x59\xd4\xdf\xa5\xff\xe3\x37\x72\xe6\x59\xd6\x67\xd6\x97\xd1"
      "\xbb\xc5\x99\x99\x02\x6d\xa5\xc5\xdc\x95\xb3\xa9\xfb\xe1\x28\x8c\x31\x5e"
      "\xd3\x52\x34\xee\xff\x3b\xdc\xc6\x71\xd4\x10\x6f\x0d\xb0\x0c\xc3\xb7\x8b"
      "\xf8\x5d\x3e\x7a\x0d\x2b\x3d\x08\xa5\x4e\x58\x29\x47\x61\xa7\x4f\xfb\x51"
      "\x3a\xd7\x7c\x44\xfc\x7f\x4b\x9d\xd9\x13\xd3\xb6\x5b\xe5\xc6\x29\xad\x31"
      "\xa5\xb2\x77\x3b\xa4\xf9\x32\x26\x27\xa6\x0f\x9f\x98\x8b\x35\xff\x2a\x44"
      "\x4a\x58\xd9\x94\x33\xe8\x9b\xf7\xff\xec\xeb\x48\xd7\x55\xf7\xde\x15\x43"
      "\x27\x08\x16\xaf\x96\xef\xa4\x12\x45\x22\x07\x98\xc7\x44\xf5\x40\x8f\xb9"
      "\xc6\xf7\x90\xcd\x68\x33\xec\x32\xee\x44\x81\xce\xb1\xc2\x0a\x91\x7a\x21"
      "\x80\xdd\x13\x2c\x3b\xba\x0b\xc4\x78\x86\x17\x96\x21\x7b\x13\x68\xc9\xcd"
      "\x56\x86\xd5\xe2\xe7\x46\x80\x4c\x4c\x75\x9e\x22\x51\xb4\x09\x85\xfb\xbe"
      "\x60\x1d\x03\x29\x32\x3e\xd9\xcf\x82\x52\xe8\x3c\x1c\xc7\x32\xbe\xc6\x5b"
      "\x7e\x6a\x52\x0b\x18\x76\xde\xe4\x31\xc8\x29\x58\x23\x4e\x50\x2f\xcc\xd5"
      "\x9e\x71\x3d\xea\x65\xd6\xaf\x3b\xc6\x44\xe2\x30\x49\x72\xf9\x7a\xce\xb4"
      "\x90\xc2\x03\xed\x09\xcc\xd5\xd4\x62\xa5\x33\xa8\xf8\x64\xb8\xc4\xbf\x5c"
      "\xa5\x6e\xa8\x89\xbc\xdd\x20\x58\xc2\x93\x91\x22\xf1\xac\x93\x91\xbe\xa4"
      "\x24\xe1\x75\x7c\x8f\xcb\xe0\x5c\xaa\xfd\x6a\xa6\x91\x9e\xab\x8e\xef\x8f"
      "\x70\xfc\x68\xdb\x3a\x0a\x62\xfc\xb9\x36\x0f\xae\xbb\xf7\xfd\xd1\x0b\x07"
      "\x63\xab\x72\xf6\x3d\xdc\xc4\x1b\x90\x48\x2d\x51\x2d\x54\xff\x9c\x4d\xc5"
      "\x27\x00\x5f\x61\x88\x5e\x40\xf1\x7b\x26\xb5\xc2\x31\xf1\x56\x5b\x77\x29"
      "\xa8\x4e\xaf\x9d\x84\x3b\x30\xdb\xe7\x43\xaf\x52\x7c\x93\xb7\xa4\x6b\x20"
      "\x37\xc6\x61\x17\x47\xdb\x8a\xb3\x94\x6d\xe3\x86\x7b\x22\xb4\x82\x5c\x6f"
      "\x20\xf4\x6e\xfb\xbc\x55\x57\x95\x17\x18\x72\x4f\x0e\x3c\x27\xcc\xcd\x94"
      "\xf3\xed\x19\x58\x13\xf2\xd8\xd6\x38\x84\xa9\x21\x16\xd3\x84\x91\xc7\xc7"
      "\x7a\x05\xae\x5c\x50\x70\x3f\x6d\x8f\x7a\x42\xb2\x25\x29\xdd\xe5\xcb\x1c"
      "\xbc\x75\x88\x1f\xe5\xd1\xfb\x5a\x7f\xb4\x47\xce\xc9\x9e\xac\x4d\x02\x27"
      "\x1a\x69\x3b\xae\x9c\x36\x86\xcf\x56\x2c\xdd\xb7\xdb\x51\xbd\xbe\xf5\x17"
      "\x0c\xb9\xfc\x3b\x10\x71\xb9\xb0\xb2\xa7\x5b\xc3\x7f\x43\x59\x97\x3c\x4a"
      "\x6f\x5e\xf1\x78\x86\xa0\xa1\x08\x0e\xf5\x65\x7f\x15\xbc\x4a\x3e\x1f\xe9"
      "\x03\x03\x9a\x3d\xb5\x13\x81\x30\x72\x5b\xde\x13\xa3\xcf\xbf\x94\x4e\xee"
      "\x0c\x57\x17\x59\xdf\x70\xfa\x80\x12\xf2\x6f\x18\x7a\xf3\x80\xc6\xe8\x22"
      "\x6e\x16\x92\x45\x41\x6f\x5b\xde\x76\x9d\xb5\x62\x85\x14\x28\xd0\x64\x30"
      "\x38\xea\xe7\x09\xc0\xd0\xa6\xcf\x19\x48\x4d\x7c\x51\x62\x7f\x43\x36\xe7"
      "\xdc\xf8\xc2\x23\x35\x30\xdd\x63\xd1\x78\x11\x3a\x1e\x9c\xd4\xf3\xae\xd3"
      "\x7c\xf3\xc4\x0a\x37\xd1\x47\xe2\x34\xa7\xc7\x13\xf7\x71\x88\xca\x8a\x59"
      "\xc8\x1c\xee\x84\xe4\x62\x46\x7f\x1c\x59\x68\x18\xa1\x83\xa4\xb1\x82\xb7"
      "\xe0\x47\xe6\xa9\x9a\x72\x86\x55\x8b\x97\x76\x4c\xf8\xdc\xe4\xba\x9d\xc1"
      "\xae\x99\x77\xc6\x43\xc6\x24\x04\xb7\xff\xe4\x13\x69\xac\x27\x8b\x81\x24"
      "\x4c\x18\x32\xcc\x01\xed\x0e\x6f\xd7\x9f\x00\xe5\xb5\x4f\xd3\x8d\x0e\x29"
      "\x8a\xf9\xed\xa1\xab\xbe\xfc\xe8\xfc\x74\x6d\xba\xbe\x8c\x0a\xff\xbd\x10"
      "\xce\x67\x14\xbb\x62\x74\x68\xbd\x27\xf3\x38\x95\xf8\x6f\xd7\xe0\x4d\x43"
      "\x3d\xa6\x3a\x60\x8c\x43\x46\x64\x7b\x7b\x10\xe5\xe6\xa3\xaf\x6b\x1f\x25"
      "\xf2\xe1\x4a\xfa\xfd\x7d\x0a\xc2\x33\xc3\x42\x2d\xc8\xdc\xa0\x93\x6f\x95"
      "\x52\x47\x0f\xe7\xe4\x09\x0e",
      1321);
  *(uint64_t*)0x200025e8 = 0x529;
  *(uint64_t*)0x200060d8 = 3;
  *(uint64_t*)0x200060e0 = 0;
  *(uint64_t*)0x200060e8 = 0;
  *(uint32_t*)0x200060f0 = 0;
  *(uint32_t*)0x200060f8 = 0;
  syscall(__NR_sendmmsg, r[0], 0x20005fc0ul, 5ul, 0ul);
}
int main(void)
{
  syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
  syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul);
  syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
  loop();
  return 0;
}